Agreed.
But until we have a better system of plainly showing access levels to one's account its a scammer paradise to allow access via said API.
You and I are educated in the world of API access, so will think twice before clicking "agree" to allowing emoji corp access to my bank account to "verify your identity", but a significant number of people would blindly click allow. Until we have either educated the public, or made an access GUI that stops 99.9% of that kind of use case, its just not worth the hassle.
Nobody says such API would be connected to a person's life holdings. It could be low amounts that are safe to lose in case of a hack.
Of course, you need to educate people to not put all their life savings into those accounts. But the same applies to multiple other services.
How so? There's no reason a bank account shouldn't be programmable. If the worry is fraud and account hacks, that already happens when the computer is compromised or people get scammed.